A help desk technician receives a call from a user who says many of their documents now have strange file extensions and a ransom note appeared on the desktop. The files will not open. What type of malware is the user most likely experiencing?

Spyware that silently records user activity over time

Spyware usually watches or steals information without immediately locking files or demanding payment.

A worm that spreads mainly by scanning for other hosts

Worms focus on self-replication and spreading, not typically encrypting local files for extortion.

A rootkit that hides malicious processes from the operating system

Rootkits are designed to hide presence and maintain stealth, not usually to lock files for ransom.

What does this SY0-701 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Ransomware that encrypts files and demands payment for recovery — The best answer is ransomware. The key clues are the unreadable files, strange extensions, and a ransom note demanding payment. Ransomware is designed to deny access to data, usually by encrypting files or systems, and then extort the victim for a decryption key. In a help desk setting, this is a high-priority incident because the response often involves isolating the device quickly to limit spread. Why others are wrong: Spyware is focused on covert monitoring and theft, not file encryption. Worms spread across systems automatically, but the question describes locked documents and a ransom note. Rootkits try to hide malware and maintain persistence, which does not match the visible extortion behavior described here.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.